The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is parsed successfully instead of being rejected. Because of that, a crafted DER input can cause `SigningKey.from_der()` to raise an internal exception (`IndexError: index out of bounds on dimension 1`) rather than cleanly rejecting malformed DER (e.g., raising `UnexpectedDER` or `ValueError`). Applications that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in a denial of service. Version 0.19.2 patches the issue.

According to the versions of the python-ecdsa packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support     for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm)     and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing     functions can cause unexpected exceptions to be raised from the public API functions.
    `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the available     buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is     parsed successfully instead of being rejected. Because of that, a crafted DER input can cause     `SigningKey.from_der()` to raise an internal exception (`IndexError: index out of bounds on dimension 1`)     rather than cleanly rejecting malformed DER (e.g., raising `UnexpectedDER` or `ValueError`). Applications     that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in     a denial of service. Version 0.19.2 patches the issue.(CVE-2026-33936)

Tenable has extracted the preceding description block directly from the EulerOS python-ecdsa security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1608-1 advisory.

    - CVE-2026-33936: issue in the low-level DER parsing functions can cause unexpected exceptions to be     raised from the       public API functions (bsc#1261009).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:1436-1 advisory.

    - CVE-2026-33936: issue in the low-level DER parsing functions can cause unexpected exceptions to be     raised from the       public API functions (bsc#1261009).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support     for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm)     and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing     functions can cause unexpected exceptions to be raised from the public API functions.
    `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the available     buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is     parsed successfully instead of being rejected. Because of that, a crafted DER input can cause     `SigningKey.from_der()` to raise an internal exception (`IndexError: index out of bounds on dimension 1`)     rather than cleanly rejecting malformed DER (e.g., raising `UnexpectedDER` or `ValueError`). Applications     that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in     a denial of service. Version 0.19.2 patches the issue. (CVE-2026-33936)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support
    for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm)
    and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing
    functions can cause unexpected exceptions to be raised from the public API functions.
    `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the available
    buffer. For example, an OCTET STRING that declares a length of 4096 bytes but provides only 3 bytes is
    parsed successfully instead of being rejected. Because of that, a crafted DER input can cause
    `SigningKey.from_der()` to raise an internal exception (`IndexError: index out of bounds on dimension 1`)
    rather than cleanly rejecting malformed DER (e.g., raising `UnexpectedDER` or `ValueError`). Applications
    that parse untrusted DER private keys may crash if they do not handle unexpected exceptions, resulting in
    a denial of service. Version 0.19.2 patches the issue. (CVE-2026-33936)

ID	Name	Product	Family	Severity
326194	EulerOS 2.0 SP12 : python-ecdsa (EulerOS-SA-2026-2616)	Nessus	Huawei Local Security Checks	medium
326117	EulerOS 2.0 SP12 : python-ecdsa (EulerOS-SA-2026-2556)	Nessus	Huawei Local Security Checks	medium
323164	EulerOS 2.0 SP15 : python-ecdsa (EulerOS-SA-2026-2501)	Nessus	Huawei Local Security Checks	medium
323145	EulerOS 2.0 SP15 : python-ecdsa (EulerOS-SA-2026-2460)	Nessus	Huawei Local Security Checks	medium
320301	EulerOS 2.0 SP13 : python-ecdsa (EulerOS-SA-2026-2309)	Nessus	Huawei Local Security Checks	medium
320266	EulerOS 2.0 SP13 : python-ecdsa (EulerOS-SA-2026-2352)	Nessus	Huawei Local Security Checks	medium
310249	SUSE SLED15 / SLES15 Security Update : python-ecdsa (SUSE-SU-2026:1608-1)	Nessus	SuSE Local Security Checks	medium
307426	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-ecdsa (SUSE-SU-2026:1436-1)	Nessus	SuSE Local Security Checks	medium
304163	Linux Distros Unpatched Vulnerability : CVE-2026-33936	Nessus	Misc.	medium
439347	SCA: security update for ecdsa (GHSA-9f5j-8jwj-x28g)	Tenable Cloud Security	SCA Checks	medium
439347	SCA: security update for ecdsa (GHSA-9f5j-8jwj-x28g)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-33936

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium